berbew | afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d

Analysis

max time kernel
94s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe
Size 72KB
Sample241107-dreswatkdw
SHA256 afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d
MD5 ab7d8578e21e910a2f6cda1d0483ea4b
SHA1 21d1dd0bb44a03ec9ef411f79bfc38f689aed3aa
SHA512 969e5020ed806c0fcca3a701b0ebe5a769b7f13cd6a257b554fc4b04338ca67b0b5a3ea003dee5d4760becd71b01bb8006a95beebcc4d54ef4d19cf4f56ab1b2
SSDEEP 1536:qaObE6JrgcgBUUyhnBqgNLHRdzqpdyD5VkRC659ws+VScJwb:G46JrgcgBUl19NTRhMyduC6/ws+Iowb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://f/wcmd.htm
http://f/ppslog.php
http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djdmffnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daqbip32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 35 IoCs

pid	Process
4192	Beihma32.exe
3036	Bfkedibe.exe
3020	Bnbmefbg.exe
1724	Belebq32.exe
1184	Chjaol32.exe
4664	Cjinkg32.exe
2916	Cabfga32.exe
3296	Cenahpha.exe
1896	Cfpnph32.exe
2572	Cmiflbel.exe
3312	Ceqnmpfo.exe
3892	Chokikeb.exe
4704	Cmlcbbcj.exe
4368	Cagobalc.exe
628	Chagok32.exe
5028	Cnkplejl.exe
2376	Ceehho32.exe
1804	Cjbpaf32.exe
1868	Calhnpgn.exe
2560	Ddjejl32.exe
4796	Djdmffnn.exe
2176	Dmcibama.exe
3544	Ddmaok32.exe
3644	Dfknkg32.exe
2004	Dmefhako.exe
4816	Daqbip32.exe
4272	Dhkjej32.exe
2044	Dodbbdbb.exe
4344	Daconoae.exe
2720	Dhmgki32.exe
1968	Dogogcpo.exe
3788	Deagdn32.exe
1444	Dgbdlf32.exe
4912	Doilmc32.exe
3476	Dmllipeg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Chokikeb.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Chokikeb.exe
File created	C:\Windows\SysWOW64\Djdmffnn.exe	Ddjejl32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Belebq32.exe
File created	C:\Windows\SysWOW64\Cabfga32.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Kdqjac32.dll	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Jgilhm32.dll	Ceehho32.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Daqbip32.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Calhnpgn.exe	Cjbpaf32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File opened for modification	C:\Windows\SysWOW64\Cnkplejl.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Bfkedibe.exe	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Mkfdhbpg.dll	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Cenahpha.exe	Cabfga32.exe
File opened for modification	C:\Windows\SysWOW64\Cfpnph32.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Djdmffnn.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cfpnph32.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe
File created	C:\Windows\SysWOW64\Daqbip32.exe	Dmefhako.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Dhkjej32.exe
File opened for modification	C:\Windows\SysWOW64\Cagobalc.exe	Cmlcbbcj.exe
File opened for modification	C:\Windows\SysWOW64\Dmcibama.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Dogogcpo.exe	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dhmgki32.exe
File opened for modification	C:\Windows\SysWOW64\Ceehho32.exe	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Jdipdgch.dll	Dmefhako.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Djdmffnn.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Daconoae.exe
File opened for modification	C:\Windows\SysWOW64\Bnbmefbg.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Ceehho32.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cabfga32.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File created	C:\Windows\SysWOW64\Gblnkg32.dll	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe
File opened for modification	C:\Windows\SysWOW64\Cabfga32.exe	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Bbloam32.dll	Cfpnph32.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Pjngmo32.dll	Chagok32.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Dmcibama.exe
File created	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Gfghpl32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Bnbmefbg.exe	Bfkedibe.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2380	3476	WerFault.exe	120

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Djdmffnn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dogogcpo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmlcbbcj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmiflbel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmcibama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daqbip32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjbpaf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfknkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmefhako.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dgbdlf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Doilmc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beihma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfkedibe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnbmefbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagobalc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Belebq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cabfga32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceqnmpfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chokikeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhkjej32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calhnpgn.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijij32.dll"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmfjodai.dll"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Doilmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpdaoioe.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echdno32.dll"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdipdgch.dll"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diphbb32.dll"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Doilmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chokikeb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 4192	2856	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe	83
PID 2856 wrote to memory of 4192	2856	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe	83
PID 2856 wrote to memory of 4192	2856	afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe	83
PID 4192 wrote to memory of 3036	4192	Beihma32.exe	84
PID 4192 wrote to memory of 3036	4192	Beihma32.exe	84
PID 4192 wrote to memory of 3036	4192	Beihma32.exe	84
PID 3036 wrote to memory of 3020	3036	Bfkedibe.exe	85
PID 3036 wrote to memory of 3020	3036	Bfkedibe.exe	85
PID 3036 wrote to memory of 3020	3036	Bfkedibe.exe	85
PID 3020 wrote to memory of 1724	3020	Bnbmefbg.exe	86
PID 3020 wrote to memory of 1724	3020	Bnbmefbg.exe	86
PID 3020 wrote to memory of 1724	3020	Bnbmefbg.exe	86
PID 1724 wrote to memory of 1184	1724	Belebq32.exe	87
PID 1724 wrote to memory of 1184	1724	Belebq32.exe	87
PID 1724 wrote to memory of 1184	1724	Belebq32.exe	87
PID 1184 wrote to memory of 4664	1184	Chjaol32.exe	88
PID 1184 wrote to memory of 4664	1184	Chjaol32.exe	88
PID 1184 wrote to memory of 4664	1184	Chjaol32.exe	88
PID 4664 wrote to memory of 2916	4664	Cjinkg32.exe	89
PID 4664 wrote to memory of 2916	4664	Cjinkg32.exe	89
PID 4664 wrote to memory of 2916	4664	Cjinkg32.exe	89
PID 2916 wrote to memory of 3296	2916	Cabfga32.exe	90
PID 2916 wrote to memory of 3296	2916	Cabfga32.exe	90
PID 2916 wrote to memory of 3296	2916	Cabfga32.exe	90
PID 3296 wrote to memory of 1896	3296	Cenahpha.exe	91
PID 3296 wrote to memory of 1896	3296	Cenahpha.exe	91
PID 3296 wrote to memory of 1896	3296	Cenahpha.exe	91
PID 1896 wrote to memory of 2572	1896	Cfpnph32.exe	92
PID 1896 wrote to memory of 2572	1896	Cfpnph32.exe	92
PID 1896 wrote to memory of 2572	1896	Cfpnph32.exe	92
PID 2572 wrote to memory of 3312	2572	Cmiflbel.exe	93
PID 2572 wrote to memory of 3312	2572	Cmiflbel.exe	93
PID 2572 wrote to memory of 3312	2572	Cmiflbel.exe	93
PID 3312 wrote to memory of 3892	3312	Ceqnmpfo.exe	94
PID 3312 wrote to memory of 3892	3312	Ceqnmpfo.exe	94
PID 3312 wrote to memory of 3892	3312	Ceqnmpfo.exe	94
PID 3892 wrote to memory of 4704	3892	Chokikeb.exe	95
PID 3892 wrote to memory of 4704	3892	Chokikeb.exe	95
PID 3892 wrote to memory of 4704	3892	Chokikeb.exe	95
PID 4704 wrote to memory of 4368	4704	Cmlcbbcj.exe	96
PID 4704 wrote to memory of 4368	4704	Cmlcbbcj.exe	96
PID 4704 wrote to memory of 4368	4704	Cmlcbbcj.exe	96
PID 4368 wrote to memory of 628	4368	Cagobalc.exe	97
PID 4368 wrote to memory of 628	4368	Cagobalc.exe	97
PID 4368 wrote to memory of 628	4368	Cagobalc.exe	97
PID 628 wrote to memory of 5028	628	Chagok32.exe	99
PID 628 wrote to memory of 5028	628	Chagok32.exe	99
PID 628 wrote to memory of 5028	628	Chagok32.exe	99
PID 5028 wrote to memory of 2376	5028	Cnkplejl.exe	100
PID 5028 wrote to memory of 2376	5028	Cnkplejl.exe	100
PID 5028 wrote to memory of 2376	5028	Cnkplejl.exe	100
PID 2376 wrote to memory of 1804	2376	Ceehho32.exe	101
PID 2376 wrote to memory of 1804	2376	Ceehho32.exe	101
PID 2376 wrote to memory of 1804	2376	Ceehho32.exe	101
PID 1804 wrote to memory of 1868	1804	Cjbpaf32.exe	102
PID 1804 wrote to memory of 1868	1804	Cjbpaf32.exe	102
PID 1804 wrote to memory of 1868	1804	Cjbpaf32.exe	102
PID 1868 wrote to memory of 2560	1868	Calhnpgn.exe	103
PID 1868 wrote to memory of 2560	1868	Calhnpgn.exe	103
PID 1868 wrote to memory of 2560	1868	Calhnpgn.exe	103
PID 2560 wrote to memory of 4796	2560	Ddjejl32.exe	105
PID 2560 wrote to memory of 4796	2560	Ddjejl32.exe	105
PID 2560 wrote to memory of 4796	2560	Ddjejl32.exe	105
PID 4796 wrote to memory of 2176	4796	Djdmffnn.exe	106

C:\Users\Admin\AppData\Local\Temp\afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe
"C:\Users\Admin\AppData\Local\Temp\afc477e850bfac03ff5fb909f0cea8c5766f15db2a311ffdefd4daaa6d9aae6d.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\Beihma32.exe
  C:\Windows\system32\Beihma32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\SysWOW64\Bfkedibe.exe
    C:\Windows\system32\Bfkedibe.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\SysWOW64\Bnbmefbg.exe
      C:\Windows\system32\Bnbmefbg.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1724
      - C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1896
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4368
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2176
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3644
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2004
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4816
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4272
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2044
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4344
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2720
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3788
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1444
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        36⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3476 -s 408
        37⤵
        Program crash
        
        PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3476 -ip 3476
1⤵
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Beihma32.exe

Path C:\Windows\SysWOW64\Beihma32.exe
Size 72KB
SHA256 7e53db634a5920bdfa9b7792b1cfd1b226cb2946f4371770baf55d1c8078ea10
MD5 50ab3398f2cddeb30f15470044e43e4d
SHA1 5513d46e38b4d1c55227e8697efc21b1f74f451b
SHA512 d02eed4665d4beceb4d1516bc3c9eb1d7adc9417371c22c9726b31b3e80a7b253f296293758f9341821218fdb48c4a19cd7447de66d67841f55358fc8c484d28
SSDEEP 1536:ZXJUKlmtD5BWzux7kaz6ZCmjzO+65SRH3/h/1wGGV:x7mZLIZ3O+vRH3/h/1wGGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Belebq32.exe

Path C:\Windows\SysWOW64\Belebq32.exe
Size 72KB
SHA256 516ab2516e5085d92a99744a608c592958bd7b80616c31e723245e631bc786b8
MD5 b48d84e43910b21f91c59993173f32de
SHA1 d568fb1c50e5e2b968dd628bbdb6b1dd3c5a6dea
SHA512 39db3bd2234f8119f5dc4b49baaa8cbbf800991bf82600385f1d00759686b82b49889d2de2308f3f1e938de25cf45e0b2b8cfb2518144c9301c6e13eb2316794
SSDEEP 1536:Fd7L68GZrlJ4AAt9BbwP0GFYkdUjkAC/kUTu3hd5n:Fdn63Zf4AmrbKCCTT4hfn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bfkedibe.exe

Path C:\Windows\SysWOW64\Bfkedibe.exe
Size 72KB
SHA256 c5947061ffcb4905cf082ad7025f5abb9340b37f0aa9211540061c45f2a8df12
MD5 823c77d89d8da8a45fcd824fac50d099
SHA1 5eade151d2b2ff49cf384ddbb7d56c685213ed9b
SHA512 1d322d449d3785791dec7b472080d54c1526619bae9aebdee0827c32c500a770ea737e46a6e5d780e2dff3fe8260834e9093fa1169a1322393e598bfa1233622
SSDEEP 1536:nI+0hteyZk5FpSIQTtdTv22dW9npUC8QrBc3S5k:qNZkPpX6dTvP0zU9QNiS5k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bnbmefbg.exe

Path C:\Windows\SysWOW64\Bnbmefbg.exe
Size 72KB
SHA256 a068b53583c1040a115f7f1a0e1fb261285f84f677e4cb74858c2af0887fbb58
MD5 23ef79cee362c031e8f5d3554ac2baa9
SHA1 0a419c339e586a8be9d409753cf56405f9bc518f
SHA512 a8aa965b883f0bc1af53d915f0f5f347d36c64605d53057d71ee8d0ba1045b134f5c6d6db333c55008ee378646bd6d39654f13716cf1b0cc96b90871791db392
SSDEEP 1536:egzV2B3LyWyXG+nLun9Xj1ntcZcjNAIQxbcdC:exB3GWAG+n6n/Gy2IabcdC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cabfga32.exe

Path C:\Windows\SysWOW64\Cabfga32.exe
Size 72KB
SHA256 5c3c8e54d4a5e21ac628e40ad4922fb28b6c380c07621c5d26547cf7535cb3f4
MD5 bb3ff3414925365fd400387958d1e7dc
SHA1 3411927873495679d85069b7f33ff08eb82d7642
SHA512 75d98ac1e91d9a1fef4d4703811ea7524aefc131035d54b0862d2c0e0923443a64e459a2df4ae3a80b583dbcd003be0819f66e0711f72b1a4f6ad5296e57845b
SSDEEP 1536:pEiMDL+8RcjjuKih5UwW78oPc2fd5axwaei1aRWFv:tUVKizW8hpeiwWFv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cagobalc.exe

Path C:\Windows\SysWOW64\Cagobalc.exe
Size 72KB
SHA256 543e55f734c205c55a2447721ff2d228b442e7c8bc06e8e7416a5391172e0fcc
MD5 aeaaf4fa883ef578b1fb391d768e125e
SHA1 69713c21c0ef516720b7336bf4debbb8ceec20f8
SHA512 d6ac87d8b3757cdfdfbc36df21cdb6ab99688485c076da4d0b3374b6608cc5c4b499cbebe97e4afda7f156f1fec018c18cec2120393f6b581c4e8ac93002091c
SSDEEP 1536:Rr8V5438KqxQrDJ8szobZKzJuvLPGdK3TCrCKZ:RoY4QrFzzobZKzJsLPGdEOuKZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Calhnpgn.exe

Path C:\Windows\SysWOW64\Calhnpgn.exe
Size 72KB
SHA256 ec38f210f8d8d23ae2cef94a3a7287240aa879f795fd995ea909a0f71140fd0d
MD5 90f4c6d18df9e9b4682f11f457cc281a
SHA1 51d34f413a9f35b309e58297f8640afcf922eb71
SHA512 6100ef3cef7743b4476ea3413eaedcb97fa29a36c2bd201ac0ae3630f25e874f76b7060704d3c2aac519bbf59f7ede9c4380668c7a4dccd61b8f95a87926fe2a
SSDEEP 1536:1cYpHBCeP+hzkkiPmO2X4lQ88h4r3jR4I8PY:53P+JDiPpgnJh4rTAY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ceehho32.exe

Path C:\Windows\SysWOW64\Ceehho32.exe
Size 72KB
SHA256 67a11af627b39a02b3f5e3b2419c002b26150180465edab989ba38357b2469e4
MD5 8b03a13ec39d0d2adc4188eec59f7ae3
SHA1 9937b43c3d1d6bc2518d1510e01fd6e1e608de4a
SHA512 a212797fac7337c0c1e2fdedd8f706e537b37236858e0f859ac45e11bd54ef1a526d09e2887c1cf4bebae38d3bb257adc2ab55053f21ad2e482123d406cafe7c
SSDEEP 768:cuIC7b9aML/MBkb40gngtW1kQiwkZy0xTUVobT/cvZgiT5i+4KjSHkWWWWWWWWWf:cG9x7Mu49kQ8oC/cR3vjOPr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cenahpha.exe

Path C:\Windows\SysWOW64\Cenahpha.exe
Size 72KB
SHA256 414be8ac4cbe449f635bee501ec3b3a8670fae4175c7bcdfb2218c4b11eee648
MD5 b83608bfa7061bfea65a5d3e25c21558
SHA1 83b87854b8bebfaa8bf152ce13adb5b731273807
SHA512 d6c8059dc4b4e26d870e3c76606405a1083921217a9ce9dbf4eb6dd01fb622e11fed9f02ee6cf96655860cae931750c60d114179879f6779045937ca9b16f125
SSDEEP 1536:Xq/S0JywJsXnLOp6oRO6RaaBkCSN/72u3NvPnds:aTJsXLH6fkU8vPnds
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ceqnmpfo.exe

Path C:\Windows\SysWOW64\Ceqnmpfo.exe
Size 72KB
SHA256 f778edbe2e633b1fc106c26bb0ff82d2885e6924e5d1414ec478ff50260f9a52
MD5 9aa0d79c554a8331d0bb6926fe989aa9
SHA1 7be1e94e8bbf04574d5f99aeaf0ecc221a3e48fe
SHA512 39e37c421230871410f0e6d5264b88fd52beea57165927a659d54748a65ba9b5f731c5483834dfaea6d4f012335bdc4864d1aed74f20eaba48c41555f21270fa
SSDEEP 1536:+z4jXvyiHeTwrnxmoaZnCsQueKxAciNEJDm/nEtW6fCXaI:+zQhHowDxfanQnKx4NEJDm/waXv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cfpnph32.exe

Path C:\Windows\SysWOW64\Cfpnph32.exe
Size 72KB
SHA256 9f2440397645ac268f704c31b1309aa8d7fde6ef0b19f28c20db58f8c6b0e9db
MD5 e10fde9cdef312f4184f48f2f5111af4
SHA1 5c123f1e375f39479f35a8ab63014632ae6a603e
SHA512 d971f68f7b4a39753b5def97837ba0194cbedaf8a280379161b6114e702dfef4e45f34f085e7a026904829074cbc2243b126e67d32e5ad2968041b1a56d8c3a2
SSDEEP 1536:nba77izD+f9QkoBWBXVr5ivF3Rnw0eAj547ZnVS:nOSD+FyYbgvFlw0eAj5YVS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chagok32.exe

Path C:\Windows\SysWOW64\Chagok32.exe
Size 72KB
SHA256 cf2788b7f9c76becdcef0ce2bac6245775d95996476550f828f91895802f8389
MD5 92fe5f11e5ca207a088085aa5cd3f7bf
SHA1 b06d3371f6a7db5e38decbccc860e25e846c07aa
SHA512 9bea1d40f361fd5fc05c499b6b39d8793e74d76549d43950fa422b120679512c0a2c909e0c8e9947a976aa1b58c27ccb4d0031cb69953e1e2dbfaf3b4c6f2abe
SSDEEP 1536:+495ZXR6Cw8wCYYnZxvJEtIFBLuRXmsk2TKHTcZ61Uk0Y:+CECYYnPRqRWnH1WY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chjaol32.exe

Path C:\Windows\SysWOW64\Chjaol32.exe
Size 72KB
SHA256 07184fd593a5d01773789d58b99d5afac0a063aa631c59be2bb26dbb5bd24024
MD5 0b7451e026294729be6b747b24d94468
SHA1 a751111f5bb62a7aced082a5bc32eccf8de562b8
SHA512 436f79065d7b5a3a8bf526e8912a0ada0e69309dd9c31e5b0d5125e6cb2533011d405184e7e03154fbdfbf7b9f21e9fe70312a4556853e31ae566df04ec7f20a
SSDEEP 1536:ABdxfomRFYabKzrE1Urr9K2HIltGCr1rkdYDPtZEi:29YpzrFmIYDPPp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Chokikeb.exe

Path C:\Windows\SysWOW64\Chokikeb.exe
Size 72KB
SHA256 78584c34f4cacab5d410f86821dcb677a2eb842d82bb70abbc9356f480330a5a
MD5 ce2c6b65e12967e5efb9ee69d2e8e8a3
SHA1 2afa1b8d269253013486c6e46610a608370ba7eb
SHA512 f0062a4af83f290eae6736a32ab79fbeebc6f0a9a97ade9c26e8022b741984d04a9a8ea392795b1cc8dc1dd397d9fd0fca3dee918cefd9e8ddb176e64884c358
SSDEEP 1536:vAjh+a+TyYFintC77CGdaxfFAU3Kv6ArXcOn2JMYvVCrXTEnx:vAjdYFintCCGSao9nx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjbpaf32.exe

Path C:\Windows\SysWOW64\Cjbpaf32.exe
Size 72KB
SHA256 0d93b47184bb852a1b58f1f1e2b5f7dfd97f574d6ec7ae33d30ed7216930171a
MD5 5141c549d6864ab44a4f646662ec47d8
SHA1 6703a764b45f24f6f622775b67dcb3a67ad242c3
SHA512 8adff2613e80cc4f86df2cf6b5c1b89281602b02465e7667f2532366c7a2a653baaa86b543c664631cb44f4efd47f747f69f1074fa3a567c47899d41cbd95586
SSDEEP 1536:rJwDywiZEsTive7qO0jcK1FpFHe5A3ivpHxWmDbG3yTXBoKh17qFZ5:VwpiZuTO0jL1ZKLe5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cjinkg32.exe

Path C:\Windows\SysWOW64\Cjinkg32.exe
Size 72KB
SHA256 10ce1875d929f86e366a088f6ba2a79a2addb23089269c98cd8b870ed05986dc
MD5 f7a46cf9126682dbc981b535f69c032f
SHA1 130cf460cada836757f18d1578e30ca174e76311
SHA512 5ad80a8e03f60f93694bd3df04879dcfd40abaa08430135567aaf65548195cad53435cbb59d5becb35ce30f588e4b6e737932b0332667faf826e22d53e410421
SSDEEP 1536:tjMTo23cdyF4nzApsDh+qTSEbFwPC61JG5s5T8:tjMGdyFbpsDh+lewfR5T8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmiflbel.exe

Path C:\Windows\SysWOW64\Cmiflbel.exe
Size 72KB
SHA256 9cb0b3b8d3869e7c148806345d0c09e5dd2496ab804765b35da4dc2efd2b3d34
MD5 4ba22c41f64e00cebeb0483fd8b1f240
SHA1 87d004d137523949c1897457f50216f119d960ea
SHA512 9f56037dff86573b74473af8e3a5923eb70f060c91e78e02b0986dd6e950ed91fbfafb5f7aea86bc5b8b3cc917eecb838f418775ba22a08f3b704017e12e0e90
SSDEEP 1536:wxiHshnRdaT6qH5ul9tNiR6EABhAo2hdl:/sh6TtUtInYAoCj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cmlcbbcj.exe

Path C:\Windows\SysWOW64\Cmlcbbcj.exe
Size 72KB
SHA256 80610ddbb8e0862b2abded9c3d170ef0df04ac111a09f5ac9316a3c72ce548c1
MD5 ed1c92c7c41473abd476025a045adf09
SHA1 19dd84c912eb9721117fd180664915e2ae5f760f
SHA512 95144677da89f9bde7a6d9f9ba6301bd7d7ced01786d9cca547ee6af8b04a82a9e951778be14b9e7528045e3b18344e40d56a69eef96cbb1d4a4f7e85b71596b
SSDEEP 1536:MS+INNvpyE5su8fcE7bHseNxQhRk1LNeT:MSNP95qUYH18k1MT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cnkplejl.exe

Path C:\Windows\SysWOW64\Cnkplejl.exe
Size 72KB
SHA256 b69be3b81a54cc3bbfa55444da690c98073a87a4c59bcfa522f95890eb03baff
MD5 c416feb7ec60e7003db52e485f5e27be
SHA1 37570048bd8e440f072f351cb412f3ced4a0f9fd
SHA512 d15b9535b4dc3f35995837948382ca59ecbc414473a522fd21e660555ec77e7c691476394693ff9d98353876f66d55e62f4c2cee0f975b5d8e73692421c1a00b
SSDEEP 1536:aNoHuS6qyL5gD3yVnhhAvBpdPMF2nnBGazqc1OGYn:5yL5Y2KBgF2nnQaWc1OGS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daconoae.exe

Path C:\Windows\SysWOW64\Daconoae.exe
Size 72KB
SHA256 015e415ad9c9419bd755b36c36a3b2afb6f0f61cec7dbd3d82613a0fcfe47dd6
MD5 87e1614dfb0d1a350fb3d42391351bfa
SHA1 97df23a9d894e3c67e86ede871ff549f4cdabe2b
SHA512 55b638727766905177c56dc3c7b1a9f1d3356e1c7c07b1a191748a3fcaba9d8a358736a27bbd71a025fb473d3288ab966ed8d4f9bac844a2770cab4282279fd5
SSDEEP 1536:qqgjiOn6aOGFcvrEtYBZ+RygpiL1W1Uj8eZokg840wMA3zvLHD/bXThH6M:UjZ1FcYtYBZ+R7piUSj80okg840wMA3t
MD5 SHA1 SHA512 SSDEEP

Submit Download

Daqbip32.exe

Path C:\Windows\SysWOW64\Daqbip32.exe
Size 72KB
SHA256 34112058f2bbec5bf0aa5d71395918cf0ad29e2a51615e1c42e43f3ba4390b48
MD5 2f57e42604c2dffe3faacdafa50eaf5a
SHA1 2ee1cdb32c77027ac483effb2096c8fc1011d6ec
SHA512 531b9078bd09f1c0f4a5df48186a50b1a31667c066039175d54aca51938cac38a5b347ef1836da32ddf3602fdb9d6e4a0a542a962e4d9486f5301d0a3fc249c2
SSDEEP 1536:c6k0asKxprBF5D8oKYnHjYf2OLlwheygG0/xkxnLxxoJVI5ILZL:wNJKgH4lpyyKgZL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddjejl32.exe

Path C:\Windows\SysWOW64\Ddjejl32.exe
Size 72KB
SHA256 766aac95de0c2c0cafd9fd31b3446e86368d146734f4fb0a80d44acce074ad1a
MD5 99c243af9cd2c5dc2093ba2d1f128902
SHA1 38e03b2fa51ed81a044d4b8a9f12dbacab131c62
SHA512 69743ad08d71f77bd634246f8f059550f1c4f3d0f92602d503bc5eea151360d06ec236387a9e43d9fa49a4c582cf6f385fe11ed74632c003163d237e61498587
SSDEEP 1536:EXmAaTad0efvzGi/EOo7Up+FMNn/Wh/P6Vin22M52RPULQh:EpsadJvXEOo7UpFNn/YPxCgOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ddmaok32.exe

Path C:\Windows\SysWOW64\Ddmaok32.exe
Size 72KB
SHA256 2df2c65f48efd8e51a107b3e453e8770789110ef5dbe5f1913785a249dc48004
MD5 cecdbde38525c0fee7910f1e8e6fcd80
SHA1 817ec03127c3d5fdd87f38b7802f7586f6223e82
SHA512 ac094b022efc5d60003054adfe95b59c5cf615acaf7c3e98b2fd0e959d11011a2eec5634dc7da0ad5a3ce6254a590ed5f3032c09ccf418cf92ee7458b3d96d10
SSDEEP 1536:7quVnrN/OB4jond3tQAgaLwUDNy3HvV7P5iH:7JAKAtjlLwtYH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Deagdn32.exe

Path C:\Windows\SysWOW64\Deagdn32.exe
Size 72KB
SHA256 3e2883138e4f9f774d5924eb206ae1d1b9600d9ba7ade0bb03180d54c3cdc65f
MD5 251c81512751733f6c6b43a3a6bcc432
SHA1 7dadd45f5d9e820f614604ee60029629e40a167d
SHA512 d4b12af04e3d876a48e7d936d2e282cc8e8dcbcd757c12c627966236baeceb1df785746efc14cdad44ed2ceaad239bca7446638686a501375497fdcac71c57a9
SSDEEP 1536:PkuUJBGJkMAIP1qE+fsbwKCAs2tp4pjVYizts9gMN:c5JBGJnrPcEbwKRs2tiVYi2gM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dfknkg32.exe

Path C:\Windows\SysWOW64\Dfknkg32.exe
Size 72KB
SHA256 4d811892ceb9a2cb4211d4a9e2597875076d21e1779dfef4dc78c9f9650b7439
MD5 73a2900d4dbc0b4ee5791fbb7475f67e
SHA1 c9ffc93ac5f1db355ed07451ffef3046aa8bd95b
SHA512 5a5f030b3d5d15786069bb4611b38c6c9be9f514d8cb2a89f1ea5f6fa2c8794a5b5364dbe26efb3e468e93a3450853c76a7e70ba3d0aa3b3f0069769bd70c8b9
SSDEEP 1536:4fBpQSJVy/1g+z7iGJxr2OrPZca51g+kIP:4ppQiVyx7LxqOrRc02BIP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dhkjej32.exe

Path C:\Windows\SysWOW64\Dhkjej32.exe
Size 72KB
SHA256 b82d45a0a1fb4fb2a767ad32f0ca121329f42c55cade46351ee2eb71945e6062
MD5 372f3ffcfa400a700b107fbe26df8cf4
SHA1 ec493f3ea7eae0725588929dcd4bec0cd443d7b4
SHA512 a0289ae1f27c902464524553a099a2a884d7ebe956ac0dc1366ced541ec275810ca387d9ccd0a95026392c3317eb6679d8d7fefbe86bb0f09b79e7b7de0b08dc
SSDEEP 1536:b/fZVWv13ftpllCFz+WH6GS7nVJPiLq/BccN:brM13ftpSzdaGmDPa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dhmgki32.exe

Path C:\Windows\SysWOW64\Dhmgki32.exe
Size 72KB
SHA256 5dfdd0832b615fca21e7e83c8065e24da00c09273ed2f14767cdcbb526f40378
MD5 3604dd780c83be2b10b78b8438b98064
SHA1 ef7c01c9d0abe3664c145e0f29099afe61c90b4a
SHA512 c36c60a783d1b9f8cf7cc1e65ec62e517666687137a9fb2725e999b4285e7f5df946fbec82845dcb8936759d1eff86b92da0564d6800d44d1fa456ec92f44dbe
SSDEEP 1536:Zohc7AmHFj0xREJFldMyT2lAXgI6iyzECcKgl0negklc+rh4sBfPaCWekY/A8T6w:Ohhmlj0xeJFlCZlAXgIvyzsfyhklc+rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Djdmffnn.exe

Path C:\Windows\SysWOW64\Djdmffnn.exe
Size 72KB
SHA256 abaa166819f8834a0c65e638a8987490df4d20eac1fb9f7c1e283f8e2b05210c
MD5 ef8544f7b5e90500d62fc5b4791f0db0
SHA1 f23421a155a3313454da509fe41b57026831a676
SHA512 4d7436300ecc5cca55504b5692286f571b8e7cb118624265f1396191918fc069dc63986f6a517529c9f71c57e034e35197b1ce540488941b484be0e734bbe703
SSDEEP 1536:5KmB5qmm+OBHdrTTl1Z8DJUG4do8vGPIrU8HROiwXirPK0zgTAjoYMF:EmrhvOBHZTTl1Z6JUGL8+PULRGXirK0U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmcibama.exe

Path C:\Windows\SysWOW64\Dmcibama.exe
Size 72KB
SHA256 75909bee8594cfb7fa3e4aeeabcfdd3f01dc484eb207d1275647fbfbd7ef14f2
MD5 64f3b38d547c5a2fce0b9688df45f25e
SHA1 14797f1cae06df3316bdea38ca4c2955dff32a7e
SHA512 a64f02ebbdad2f694114ec1aa20ac3cffeae3a7f06f0fcc8fd7e6f4edf377c9278ea28e9ef1c934cdf98f0ce52269bb06fe553b79dd7dfc103f5b0967a7e20e5
SSDEEP 1536:dDm8ZqG77C3MTf5qfBgpz1DeBYVX/PyzDyZ:dtZqizcJYz5eeVPPc2Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dmefhako.exe

Path C:\Windows\SysWOW64\Dmefhako.exe
Size 72KB
SHA256 138117c2d343b36979d7ffca02a3aeb9562d44b0990617d357a0d0696809c38e
MD5 7bc91590d1871f51c204cbf114b278e6
SHA1 30271c862122817dcbe6a5cacbeef4428c088001
SHA512 f5624f21b8a1afb530c34d9e2b7c883c8bb06407b34f5a1baabb972a5d303d31360fcb8f7f87ba2846ef4d7824e45554927e95d2a5c8d8b6701ba66358456d6a
SSDEEP 768:bT8593LaKJvgoOhyYDjDww0nE15tMFUvbo/YeaYAIu2mpKk1mcJ0TEIz0XLUAv8t:bobZJvFO3jDww0E1HKR/LAs3QmcSTUNE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dodbbdbb.exe

Path C:\Windows\SysWOW64\Dodbbdbb.exe
Size 72KB
SHA256 6ea6d77224de6d29c9130bd358ad95fe5bbb2834b69f9122c2e02ef56aea2ba8
MD5 e794f7c53c7b8b20b77e74f984a48496
SHA1 99ba1f2bce92f3557a77037b61e292b66ce7d395
SHA512 e69dda4163c5aa63c0ee020bbebda6a19a66b2d6822bbc5c3329cf57f106187c3104c2b0976e2951119cc7721d430e9485860a005f147982eb34fe78a890e7d3
SSDEEP 1536:7YJj7MkYRrHpU7MZfzcbdyzKmxiPA9NrP2keS3:7YJj7hgHp4MZ74ox8ANSS3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dogogcpo.exe

Path C:\Windows\SysWOW64\Dogogcpo.exe
Size 72KB
SHA256 ac53c25f24b0620af1e77f68c4264b84a407b92e1b2132626ceea5abb1440e8e
MD5 b0c3046afc56bb849ebbf99082b99c0b
SHA1 74b22493711627fb9eb2b28bfad607b513a58d33
SHA512 90d1e88af70a60d02df77cce9b506d793108e7a29b81ea65b3b6eff28382ce3874d38ca6155f1bade2e981bcc66b000b9f05464c4da808d068900a988a5518a6
SSDEEP 1536:8b47ik/i0pKixjOzwYBmwMhDKCU3dngQg5Btn+RnkcQEu8P:Ekq0LjOFBDgbQkbtn+RnkcQEFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jfihel32.dll

Path C:\Windows\SysWOW64\Jfihel32.dll
Size 7KB
SHA256 961f0e7327680bef690301230352902e1d30e7ebfc94e2a9ffecbf37c0180893
MD5 44b478afd338ce6ed8b2bc90040da6c9
SHA1 2d1f01e7e4d46ef43b6337a3662e384d81a74716
SHA512 b607895790e9e3578e98aba2cb700b64de241e7bc8eb6edef038674a154201e9b5a5c5968534d1454cddc58f33b128ef60ef8b87eb7b514a8fd4fa5cf68e4f09
SSDEEP 48:66ay5YVO3EVkApc2wp8hH1NZn5EquglQ067YbPWTMbABbgL3q9J5S2hmc:b3EVkApcX4Hiv0hbPqjq3qX5S2hV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/628-119-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/628-312-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1184-39-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1184-332-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1444-280-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1444-262-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1724-32-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1724-334-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1804-143-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1804-306-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1868-151-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1868-304-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1896-324-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1896-72-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1968-284-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1968-247-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2004-204-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2044-228-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2176-175-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2176-298-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2376-135-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2376-308-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2560-302-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2560-159-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2572-80-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2572-322-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2720-285-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2720-240-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2856-342-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2856-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2916-56-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2916-328-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3020-336-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3020-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3036-338-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3036-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3296-64-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3296-326-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3312-87-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3312-320-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3476-277-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3476-274-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3544-184-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3544-296-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3644-191-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3644-294-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3788-282-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3788-255-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3892-318-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3892-96-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4192-7-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4192-340-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-215-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4272-290-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4344-232-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4344-287-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4368-314-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4368-111-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-47-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4664-330-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4704-316-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4704-104-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4796-168-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4796-300-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4816-212-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4912-268-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4912-278-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5028-127-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/5028-310-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads